DE112018005018T5 - USER AUTHENTICATION CHECK ON MULTIPLE DEVICES - Google Patents

Abstract

An authorization check system that uses an authorization check priority list that is based on dynamic and virtual grouping of terminals that are used for the authorization check, whereby the system leads to an efficiency improvement in the authorization check priority sequence in the 1: N authorization check and in the hybrid authorization check by the authorization check logic is switched between 1: 1 and 1: N authorization check. Masking previously logged on users for the authentication priority list for 1: N authentication improves the efficiency of the authentication priority sequence for 1: N authentication.

Description

Technical field

The present invention is directed to an authentication system that dynamically optimizes authentication processing of the system based on biometric data in an IT system by relying on a distribution of user usage of terminals, thereby improving the performance of authentication processing.

BACKGROUND

The state-of-the-art authorization check in IT systems based on biometric data usually includes that a password-based authorization check of a user's identity, such as a user ID, is replaced by an authorization check that is based on a property that the User is innate, such as fingerprints or retinal patterns, or other properties known in the art. These innate properties are commonly referred to as "biometric data". In this context, the authorization check processing takes the form of a so-called “1: 1 authorization check”, in which biometric data of the user are compared with registered data of this one user at the time of an authorization check process.

Following the recent trends in the increasing demands on the security level of IT systems, a highly precise authorization check plays an important role in the biometric authorization check.

However, this type of high-precision authorization check, the biometric authorization check, requires the system CPU to perform and sometimes leads to a long authorization check time. Since the biometric authorization check requires a comparison of inputs and the data between difference data, the computing load for such a process is high and the authorization check time is long.

In some environments, a single terminal could be shared by many users. For example, cash registers in the supermarket or check-in terminals at the airport could be used by more than one cashier or airline employee.

The detection of users in such an environment could be such that each user has to log off when he leaves the terminal and each new user has to log on before he can use the terminal. If each user has to enter their ID before the biometric authorization check, this authorization check is referred to as a "1: 1 authorization check". In this case, the authorization check would be carried out by comparing the specified data and would lead to a transaction with a constant load.

The requirement that users have to log in and out frequently can be problematic in shared terminal environments where cashiers or airline employees or the like take turns on a single terminal to avoid long queues of customers . In this case, it is desirable that not every user has to log in and out, but instead a single shared user account and not a single user is used to log on to the terminal, and then a biometric authorization check is used as soon as the user closes the terminal begins to use at which a registration has already been made. The number of possible registered users for any terminal in such an environment could be in the hundreds, all using a single shared user account. Carrying out the authorization check of the users on the common user account is referred to as “1: N authorization check”, whereby a user account has “N” possible users.

It will be clear that due to the inherent nature of the authorization check, which is based on biometric data derived from the users, the authorization check must be carried out quickly if an improvement in performance is to be achieved if each user merely uses the conventional login based on the user ID and Unsubscription is required. In addition, this process must be performed while the system is in one compared to the normal 1: 1 authorization check highly stressed state, which understandably and inevitably leads to delays in the required processes.

Since this type of use requires a fast authorization check, there is a need for fast processing using the biometric authorization check.

Many existing concepts accelerate the 1: N authorization check using different approaches. In the following explanations, existing inventions aimed at speeding up the 1: N authentication check are classified into those that are relevant to the present invention and those that have little or no relevance to the present invention. These existing systems can fall into the following classes:

Acceleration based on authorization check logic: acceleration through parallel authorization check processing to execute multiple authorization check processes, multi-level authorization check through creation of representative data, etc. The acceleration of the authorization check during parallel processing is not intended to reduce the overall system load that is associated with the authorization check. Acceleration via representative data does not take into account the uneven distribution of processes and tasks in connection with the authorization check for users. Whether representative data can be created depends on the variants that are determined by the biometric authorization check of users.

Biometric authentication data related techniques: functions related to increasing the accuracy of biometric authentication data and providing additional information for the main purpose of improving the accuracy of multi-entity authentication. The main purpose is to improve the accuracy of the authorization check at the time of performing the 1: N authorization check instead of speeding up the authorization check itself.

Reduce the data area with the help of unique information: Accelerate by reducing the range of authentication data by content of operational processes and tasks for each user, by using the service and terminal identification of the terminal used in the service. The concept of acceleration and searching for each user using the service based on the terminals is unsatisfactory as an acceleration concept, since users are not aware of the constraint of the idea that there are unique terminals in an environment in which there are several at this time shared user devices are used.

Optimization through similarity: On the basis of the similarity in the biometric information obtained, point evaluations are calculated in order to interrupt and accelerate the authorization check. The use of similarity is an acceleration concept that depends on the biometric information of the users, which is very flexible but does not include any effects that are essential in the context of this case.

Existing exemplary cases of concepts and the problems of the concepts of the respective existing inventions include the following:

Accelerating the authorization check by switching between 1: 1 authorization check and 1: N authorization check: This procedure is aimed at a concept of acceleration by differentiating and switching between processes of the 1: 1 authorization check and 1: N authorization check. The existing acceleration concept by switching between 1: 1 and 1: N authorization checks is implemented under the determination condition that the presence or absence of any input of an identifier to be subjected to the authorization check is determined, which is determined by the user as a condition for using the 1 : 1 authorization check is entered. In the environment where acceleration should be achieved, it is assumed that user accesses are made using the shared user account.

Accelerating by grouping: The accelerating approach by grouping is a concept that realizes acceleration by grouping numerous data items that are subjected to the authorization check and managing the priority in the order of the authorization check and the like. This approach can be characterized as follows:

A) To be used when reducing the data area to be searched in successive authentication rounds by simply creating a list of data items whose authentication was successful. Here there is a problem in the environment with a common user account and several users, in which it is assumed that all users subject to the 1: N authorization check carry out the authorization check daily, and with the principle of simple results of the successful authorization check not for searching for acceleration options can be used.

B) Execution of a predetermined grouping at the time of registration of the authorization check. The target environment is an environment that requires further acceleration between or among grouped users. Accordingly, acceleration by sorting at the time of registration of the authentication check as acceleration in the target environment is unsatisfactory.

C) Concept related to the reconfiguration of grouped data. This is a concept that is related to maintaining the optimization of the configuration of the group data and does not make a significant contribution to an environment in which target groups are essentially established.

D) Concept related to browsing based on property data when grouping. Effective when there are significant differences in the characteristics of biometric authorization check data in the authorization check using faces and the like, but only limited effects in the authorization check using finger veins and the like.

Increase efficiency by grouping authorization check data of the same person in the 1: N authorization check. Contributes to an increase in the same person's credential data, but has a limited impact on the increase in group data.

Approaches to group acceleration and 1: N switching, and other relevant approaches, are plentiful depending on the problems addressed by prior art inventions.

However, these existing patent publications often depend on the specific problems to which they are applied and do not necessarily provide a flexible solution that applies to all conceivable cases. There is therefore a need in the art to solve the above problem.

SUMMARY

Viewed from a first point of view, the present invention provides a computer-implemented method for checking the authorization of users on a plurality of terminals, the method comprising the steps of: a) receiving computer input by a computer in order to start an authorization check on a target terminal, the biometric Has input from the user; b) determined by the computer whether the biometric inputs received by the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) if the user is the same user who was last checked for authorization by the computer for the target terminal, by the computer performing a 1: 1 authorization check of the user; d) if the user is not the same user who was last checked for authorization by the computer for the target terminal, by the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status at terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, where the masking applies to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authentication check has been accepted, grant the computer user access to the target terminal and store the authentication result in the authentication result table.

Viewed from a further perspective, the present invention provides a computer system for checking the authorization of users on a plurality of terminals, which has a computer which has at least one processor, one or more memories and one or more storage media which can be read by a computer and on which program instructions are stored executable by the computer for a) receiving, by the computer, user input having biometric input from the computer to start the authorization check on a target terminal; b) the computer determines whether the biometric inputs received from the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) if the user is the same user who was last checked for authorization by the computer for the target terminal, by the computer performing a 1: 1 authorization check of the user; d) if the user is not the same user who was last checked for authorization by the computer for the target terminal, by the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status at terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, where the masking applies to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authentication check has been accepted, grant the computer user access to the target terminal and store the authentication result in the authentication result table.

Viewed from a further point of view, the present invention provides a computer program product for checking the authorization of users on a plurality of terminals, the computer program product having a storage medium which can be read by a computer and can be read by a processing circuit and on which instructions for execution by the processing circuit are stored, to perform a method for performing the steps of the invention.

From a broader perspective, the present invention provides a computer program that is stored on a computer readable medium and that can be loaded into the internal main memory of a digital computer that has software code portions that execute the steps when the program is executed on a computer serve the invention.

According to one embodiment of the present invention, a method for checking the authorization of users on a plurality of terminals is disclosed. The method comprises the steps of: a) receiving user input by a computer in order to start an authorization check on a target terminal which has biometric input from the user; b) determined by the computer whether the biometric inputs received by the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) if the user is the same user who was last checked for authorization by the computer for the target terminal, by the computer performing a 1: 1 authorization check of the user; and d) if the user is not the same user who was last checked for authorization by the computer for the target terminal. By the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status at terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, where the masking applies to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authentication check has been accepted, grant the computer user access to the target terminal and store the authentication result in the authentication result table.

According to a further embodiment of the present invention, a computer program product for checking the authorization of users on a plurality of terminals is disclosed. The Computer program product uses a computer which has at least one processor, one or more memories and one or more storage media readable by a computer. The computer program product has a storage medium that can be read by a computer and has program instructions embodied thereon. The program instructions are executable by the computer to perform a method which comprises: a) the computer receiving user input, which includes biometric input from the user, to start the authorization check on a target terminal; b) the computer determines whether the biometric inputs received from the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) if the user is the same user who was last checked for authorization by the computer for the target terminal, by the computer performing a 1: 1 authorization check of the user; d) if the user is not the same user who was last checked for authorization by the computer for the target terminal. By the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status at terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, where the masking applies to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authentication check has been accepted, grant the computer user access to the target terminal and store the authentication result in the authentication result table.

According to a further embodiment of the present invention, a computer system for checking the authorization of users on a plurality of terminals is disclosed. The computer system has a computer which has at least one processor, one or more memories, one or more computer-readable storage media on which program instructions are stored which can be executed by the computer in order to execute the program instructions. The program instructions include: a) the computer receiving user input that has biometric input from the user to start the authorization check on a target terminal; b) the computer determines whether the biometric inputs received from the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) if the user is the same user who was last checked for authorization by the computer for the target terminal, by the computer performing a 1: 1 authorization check of the user; d) if the user is not the same user who was last checked for authorization by the computer for the target terminal. By the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status at terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, where the masking applies to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authentication check has been accepted, grant the computer user access to the target terminal and store the authentication result in the authentication result table.

Figure list

• 1 ein beispielhaftes Schema einer möglichen Systemkonfiguration einer Datenverarbeitungsumgebung darstellt, in der bevorzugte Ausführungsformen der vorliegenden Erfindung realisiert sein können.
• 2 ein Flussdiagramm einer Berechtigungsprüfungsausführung gemäß einer bevorzugten Ausführungsform der vorliegenden Erfindung zeigt;
• 3 ein Flussdiagramm einer Analyse von Berechtigungsprüfungsergebnissen gemäß einer bevorzugten Ausführungsform der vorliegenden Erfindung zeigt;
• die 4A und 4B ein Beispiel der Relevanz zwischen Endgeräten gemäß einer bevorzugten Ausführungsform der vorliegenden Erfindung zeigen;
• 5 ein Flussdiagramm der Aufrechterhaltung von Berechtigungsprüfungsergebnissen gemäß einer bevorzugten Ausführungsform der vorliegenden Erfindung zeigt;
• 6 ein Flussdiagramm der Ausführung einer 1:N-Berechtigungsprüfung gemäß einer bevorzugten Ausführungsform der vorliegenden Erfindung zeigt;
• 7 interne und externe Komponenten eines Client-Computers und eines Server-Computers veranschaulicht, in denen veranschaulichende Ausführungsformen realisiert sein können.

Embodiments of the present invention will now be described by way of example with reference to the accompanying drawings, in which:

• 1 illustrates an exemplary schematic of a possible system configuration of a data processing environment in which preferred embodiments of the present invention can be implemented.
• 2nd Figure 3 shows a flowchart of an authentication process in accordance with a preferred embodiment of the present invention;
• 3rd Figure 3 shows a flowchart of an analysis of authentication results according to a preferred embodiment of the present invention;
• the 4A and 4B show an example of relevance between terminals according to a preferred embodiment of the present invention;
• 5 Figure 3 shows a flowchart of maintaining authentication results in accordance with a preferred embodiment of the present invention;
• 6 FIG. 4 shows a flow diagram of the execution of a 1: N authorization check according to a preferred embodiment of the present invention;
• 7 illustrates internal and external components of a client computer and a server computer, in which illustrative embodiments may be implemented.

DETAILED DESCRIPTION

The present system proposes new means to improve the performance of the authentication process of an authentication system that has to perform a large number of authentication tests, such as biometric authentication, using a common user account to log on to the terminal.

This system relates to an improvement in the 1: N authentication check, in which a source data item that has been entered to be subjected to the authentication check has to be compared with several or numerous items of registered authentication data.

The system improves the performance of the authorization check by selecting suitable types of authorization checks and also by optimizing the authorization check sequence.

As an optimization element in the authorization check, the system selects the type of authorization check and the sequence of authorization checks based on distribution data from users and end devices.

Furthermore, this system improves the accuracy to obtain the authentication data not only from data of a single terminal but by dynamically using a “mutual correlation between terminals”.

In addition, as a method for optimizing the authorization check sequence, this system proposes a modification concept by concentrating on the authorization check situation in which operators use several terminals simultaneously while switching over in sequence.

Functions of the method can each improve the 1: N authorization check of biometric authorization check. Each of the features listed below independently contribute to improving performance. Therefore, a performance improvement corresponding to each method can be achieved even if only two elements are used.

These features include an authorization check priority based on dynamic and virtual grouping of devices used for the authorization check, which improves the efficiency of the authorization check priority sequence in the 1: N authorization check, a hybrid authorization check by switching the authorization check logic between 1: 1 and 1 : N authorization check, which improves the selectivity of the authorization check, and masking a user who is already logged in for the authorization check priority list in the 1: N authorization check to improve the efficiency of the authorization check priority sequence in the 1: N authorization check. The features also include the receipt of authorization check data, in which the authorization check data of the biometric information of the user is stored when the user carries out the authorization check, and the storage of authorization check data (for example biometric data), the authorization check list, user information, terminal information, Terminal grouping data, etc.

When considering an embodiment of authorization check in a case in which a common user account is used and several users use several common terminals This system relates to the mis-distribution of authorization check usage period and the use of end devices by every user.

This system then uses this mis-distribution to improve the performance of the authorization check. First, the authorization check result is recorded in an actual environment, and then the data is analyzed in order to determine an authorization check priority per terminal and period of use and finally to save such a priority table.

During the authorization check, the system reads the priority table according to the device and period of use. An authorization check is preferably carried out with a minimum number of authorization checks using the priority table based on an uneven distribution.

In actual use, users often use multiple devices on which users could log in using a common user account. In order to optimize according to the usage situation of the end device, it is therefore effective to group the end devices as a data summary target.

In the past, grouping methods based on the physical location of the terminal and grouping based on information about the organization to which the terminal belongs have been proposed. However, these methods are grouping methods which do not constitute an optimized means in accordance with the actual form of use by users.

As a means of solving the problem of the existing grouping concept, the present system achieves an optimization of the authorization check sequence, which takes into account not only usage data from a single end device, but also that of end devices, in which there is a dependency relationship between one another, by a dynamic relationship between end devices and virtual grouping the end devices is calculated.

In particular, this system suggests using the movement of users between terminals to calculate a dependency relationship between the terminals. Regardless of the physical proximity of the end device, the dependency on the use of these end devices is high if a single user frequently uses multiple end devices by moving between the respective end devices.

In addition, by dynamically calculating the dependency using data in a past fixed period, it is possible to optimize the authorization check according to the usage tendency of a terminal user.

Taking advantage of this dependency, this system uses usage data from all end devices with dynamic dependency and calculates the result with correlation factor as weighting factors in order to obtain a suitable authorization check sequence.

1 FIG. 4 illustrates an example schematic of a possible system configuration of a computing environment in which illustrative embodiments may be implemented.

1 FIG. 4 is an example schematic of a provided possible computing environment in which illustrative embodiments may be implemented. It should be clear that the 1 is only intended as an example and is not intended as a statement about restrictions or tacit restrictions with regard to the environments in which different embodiments can be implemented. Many changes can be made to the environments shown.

With reference to 1 is the network data processing system 100 a network of computers in which illustrative embodiments may be implemented. The network data processing system 100 contains at least one network 101 , which is the medium that provides data exchange connections between various devices and computers operating within the distributed network computing system 100 are interconnected. The network 101 may include connections such as wired or wireless data exchange connections or optical fibers.

In the example shown, a terminal unit computer 102 , an authentication server computer 105 , a business system 120 including a business server 121 over a network 124 with a database server 125 and a data repository 127 connected. In other exemplary embodiments, a network computing system 51 include further client or unit computers, storage units or data stores, server computers and other units, not shown.

The terminal unit computer 102 can use a web browser 103 included, which may include an interface that can receive commands and data input from a user. The terminal unit computer 102 can also have a processor and associated sensors 104 include to read and receive authentication data from a user. The commands can affect credentials. The interface can, for example, be a command line interface, a graphical user interface (GUI), a natural user interface (NUI) or a touch-sensitive user interface (TUI). The terminal unit computer 102 includes a set of internal components 800a and a set of external components 900a , in the 7 are further illustrated.

The authentication server computer 105 includes a set of internal components 800b and a set of external components 900b , in the 7 are further illustrated. In the example shown, the server computer provides 105 the terminal unit computer 102 Information such as boot files, operating system images and applications. The authentication server computer 105 can calculate the information locally or the information from other computers on the network 101 extract. The authentication server computer 105 preferably also includes an authentication program 66 . The authentication server computer 106 contains at least one processor 107 and an associated main memory 106 with a data storage 108 connected is. The processor 107 performs control functions 114 out. The data storage 108 preferably contains authorization check data, for example in a database 109 for biometric data, an authentication result database 110 , a terminal usage database 111 , a terminal relationship database 112 and an authentication priority database 113 . To the control functions 114 include, but are not limited to, features for obtaining credential data 115 , Functions for executing the hybrid authorization check 116 , Functions for calculating a terminal relationship 117 , Functions for creating an authorization check priority list 118 and a database 119 for biometric authentication data.

The business system 120 assigns a business server 121 , for example a web server 122 , with a web application 123 on. The business server 125 is through an internal network 124 with a database server 125 connected to a database system 126 and an associated data storage 127 includes. The web server 122 and the database server 125 include a set of internal components 800b and a second one from external components 900b , in the 7 are illustrated. The web server 122 and the database server 125 can calculate the information locally and the information from other computers on the network 124 and network 101 extract.

Program code and programs such as the authorization check program 66 can be stored on at least one of one or more computer-readable physical storage devices 830 , in the 7 are shown on at least one of one or more portable, computer-readable physical storage units 936 , as in 7 shown, or in the data storage 108 stored or for use on a terminal unit computer 102 , an authentication server computer 105 or a business server computer 121 can be downloaded. For example, program code and programs such as the authentication program 66 on at least one of one or more storage units 830 on the authentication server computer 105 stored and for use on the terminal unit computer 102 over the network 101 can be downloaded. Alternatively, it can be the authentication server computer 105 act as a web server, and the program code and programs such as the authentication program 66 can be stored on at least one of the one or more storage units 830 on the authentication server computer 105 be stored and by the terminal unit computer 102 be called. Likewise, the business server is preferably a web server 122 . In other exemplary embodiments, the program code and programs such as the authentication program 66 on at least one of one or more computer readable storage devices 830 on the terminal unit computer 102 stored or distributed across two or more servers.

In the example shown, the network data processing system is concerned 100 around the internet, being the network 101 stands for a globally distributed collection of networks and gateways that use the protocol series of the Transmission Control Protocol / Internet Protocol (TCP / IP) to exchange data with each other. At the heart of the Internet is a main line (backbone) of fast data transmission lines between main nodes or host computers, which consist of thousands of computer systems for business, government agencies and educational institutions, as well as other computer systems that forward data and messages. Of course, the network data processing system 100 can also be implemented in the form of a number of different types of networks, for example in the form of an intranet, a local area network (LAN) or a wide area network (WAN). 1 is intended as an example and not as a limitation on the architecture of the different illustrative embodiments.

7 illustrates internal and external components of a terminal unit computer 102 , an authentication server 105 , a business server computer 121 and a database server computer 125 in which illustrative embodiments may be implemented. In 7 include a terminal unit computer 102 , an authentication server computer 105 , a business server computer 121 and a database server computer 125 respective sets of internal components 800a , 800b and external components 900a , 900b . Each of the sets of internal components 800a , 800b includes one or more processors 820 , one or more computer readable RAMs 822 and one or more computer readable ROMs 824 on one or more buses 826 , one or more operating systems 828 and one or more computer readable physical storage devices 830 on. The one or more operating systems 828 and the authentication program 66 are for execution by one or more of the processors 820 through one or more of the RAMs 822 (which usually include caches) on one or more of the physical memory units readable by a computer 830 saved. At the in 7 The illustrated embodiment is each of the computer readable physical storage devices 830 a magnetic disk storage unit of an internal hard disk. Alternatively, each of the computer-readable physical storage devices 830 a semiconductor memory device such as a ROM 824 , an EPROM, a flash memory or any other computer-readable physical storage unit on which a computer program and digital data can be stored.

Any set of internal components 800a , 800b also includes a read / write drive or a read / write interface 832 for reading from or writing to or writing to one or more portable, computer-readable physical storage units 936 such as CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk or semiconductor storage unit. The authorization check program 66 can reside on one or more of the portable, computer readable physical storage devices 936 be stored, via a read / write drive or a read / write interface 832 read and on one or more hard drives 830 Loading.

Any set of internal components 800a , 800b also includes a network adapter or network interface 836 such as a TCP / IP adapter card. The authorization check program 66 can be from an external computer via a network (for example the Internet, a local network or another wide area network) and via the network adapter or the network interface 836 on the terminal unit computer 102 and the authentication server computer 105 can be downloaded. From the network adapter or from the network interface 836 becomes the authorization check program 66 to the hard drive 830 loaded. The authorization check program 66 can be from an external computer via a network (for example the Internet, a local network or another wide area network) and via the network adapter or the network interface 836 on the authentication server computer 105 can be downloaded. From the network adapter or from the network interface 836 becomes the authorization check program 66 to the hard drive 830 loaded. The network can have copper lines, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers.

Each of the sets of external components 900a , 900b includes a computer display monitor 920 , a keyboard 930 and a computer mouse 934 . Each of the sets of internal components 800a , 800b also includes device drivers 840 which interfaces to the computer display monitor 920 , to the keyboard 930 and to the computer mouse 934 form. The device drivers 840 , the read / write drive or the read / write interface 832 and the network adapter or network interface 836 have hardware and software (those on the storage device 830 and / or in ROM 824 are saved).

The authorization check program 66 can be written in various programming languages, including machine-oriented, higher, object-oriented or non-object-oriented languages. Alternatively, the functions of an authorization check program 66 be realized in whole or in part with the aid of computer circuits and or with the aid of other hardware (not shown).

The features of the system are described in more detail below.

Get authorization check data:

The timing of the execution of the operations in processing this mechanism is in the flowchart of 2nd "Execution of the authorization check" described.

The system starts with the shared end device logged on to the shared user account. A user starts an operation that requires an authorization check - for example, a cashier wants to scan purchased goods, or a manager wants to approve a price reduction of an item at a cash register, where a cashier enters a shopping cart with groceries, etc.

The new user enters his or her biometric data in the manner known in the prior art, for example by placing the thumb on a fingerprint scanner.

With reference to 2nd the terminal unit computer receives 102 User inputs to start an authorization check on a terminal (step 202 ), and the terminal unit computer 102 receives biometric input from a user (step 204 ), and the process ends.

The system then goes to the hybrid authorization check 3rd about as described below.

In a conventional system, credentials are recorded as an authentication log. However, in order to use the historical data of the execution of authorization checks as basic data for improving the performance and efficiency of the authorization test, personal data must be collected on every necessary element in order to be able to call up the authorization test history on the basis of each authorization test time and each target terminal. Therefore, it is desirable to store the items described as “user information database, user information table” in the database as an example of stored data.

Execute hybrid authentication data:

If a shared user account is shared with several people, an authorization check is carried out by a so-called 1: N authorization check, in which there are several check targets for the data entered for the authorization check.

To carry out the 1: N authorization check, a large volume of data must be loaded from a database and this authorization check data must be transferred. The data transfer takes place during a multiple execution of the authorization check. For this reason, the processing time is longer compared to the 1: 1 authorization check, in which the input and the check target only apply to a specific registration.

As a solution to this situation, the system of the present invention increases the authorization check performance by focusing on the mis-distribution of the authorization check as reproducibility of the authorization check for the same person on the same terminal.

One way to schedule 1: 1 authentication to run is to set the time (the timeout value) since the previous authentication by the same user, or to determine that another user is logging in by entering the other credential information.

However, if the terminals used for the system are a front-end terminal intended for a customer, it is difficult to set a simple time-out value to determine the end of the terminal use because the switch service is not simply as Task to use the device can be specified. In addition, the identification input is Difficulty distinguishing users even when multiple users use the front-end terminal in the usage environment. Therefore, existing 1: 1 and 1: N authentication check switching methods cannot be applied in this environment.

Therefore, the system of the present invention performs a preliminary authorization check to make an approximate determination as to whether the user who is currently logging on to the terminal is the same user who performed the previous authorization check on the terminal.

The speed of the authorization check 6 depends on the level of detail of the implementation form of the authorization check. First, as a preliminary authorization check, it is determined whether it is the same user who was previously checked for authorization. After this determination has been made, it is determined whether an authorization check switchover should take place. The use of this rough authorization check does not pose a security risk.

If it can be determined that the user is the same user that was checked for authorization during the previous login, a 1: 1 authorization check is performed using the data cache to check the previous user for authorization becomes.

If it cannot be determined that the previous login and authorization check were performed for the same user, or if the same user cannot be checked for authorization in the 1: 1 authorization check, a sequence for performing a normal 1: N authorization check is carried out. The system thereby improves the speed of repeated authorization checks by the same user, which forms the majority of the use cases.

The authorization check execution logic itself can use the existing authorization check logic such as use a biometric authentication process.

The operations that distinguish the authorization check in the present system consist of the following two parts.

Execution of 1: 1 and 1: N authorization check including preliminary authorization check

3rd shows a flow diagram illustrating the selection of 1: 1 or 1: N authorization check.

After receiving biometric input from a user and credentials from a user 2nd determines the authorization check program 66 whether the biometric data indicate that the user who is currently logging on to the system on the end device is the same user who was last checked for authorization by the system (step 220 ).

If the user is not the same user who was previously checked for authorization by the system, or the user cannot be checked for authorization (step 220 ), runs the authorization check program 66 a 1: N authorization check (step 222 ), and the procedure closes 6 which will be discussed further below.

If the user is the same user who was previously checked for authorization by the system (step 220 ), runs the authorization check program 66 a 1: 1 authorization check (step 224 ).

If the authentication information is not accepted for the user (step 226 ), the procedure goes to step 222 execution of the 1: N authorization check, and the procedure goes to 6 which will be discussed further below.

If the authentication information is accepted for the user (step 226 ), the authorization check result is stored in an authorization check result table (step 228 ), the authorization check program 66 grants access to the terminal for the user (step 230 ) and the process ends.

Function for executing the 1: N authorization check with mask function of the authorization check priority list in order to exclude an authorization check for the user who is currently logged on at another terminal

Upon receiving a credential request, the system performs a preliminary credential that can be run at high speed with great granularity using the biometric credential information entered and the previous credential information.

This authorization check is not the final authorization check, but rather the determination of a possibility whether the user is the same as the previous time.

If the user is determined to be likely to be the same user, a 1: 1 authorization check is performed using the data of the last user who logged on. On the other hand, if it is determined that the user is very likely to be another user, execution proceeds to the 1: N authorization check.

Execution of the 1: N authorization check function with mask function of the authorization check priority list in order to exclude an authorization check for the user who has just logged on to another terminal

In the 1: N authorization check, the authorization check is carried out in sequence on the basis of the biometric authorization check entered and the authorization check priority list.

However, the authentication priority list is a list based on the previous authentication status. For this reason, unnecessary authentication processing may be performed because the user currently logged on to the other terminal is ranked with a higher priority in the authentication priority list.

Therefore, the read authentication priority list is created as a temporary authentication priority table. Since this is a temporary table, the main memory is preferred for storing such a table.

The next step is to use the authorization check result data to search for the current login data, then the identified user ID is deleted from the temporary authorization check table and the authorization check execution is rewritten as a meaningful table.

Finally, the authorization check is performed in the order of the data described in the list of the updated temporary authorization check priority table.

Calculate device relationships

In the 1: N authorization check, the validity of the priority list is the most important factor in improving the efficiency of the authorization check.

To increase the accuracy of the authentication priority list, the localization of the authentication priority list must be expanded. This means that it is not a matter of the priority list in the entire system, but rather the creation of priority lists in the group or at the terminal level.

In this case, there is an adverse effect of redundancy by expanding the location when the authorization priority is used. This present system focuses on the fact that reducing this redundancy contributes to high speed.

Particularly in the case of an environment using a shared terminal, the same user uses multiple terminals. As a result, registration of the same user in the priority lists is a situation that can typically arise in this type of use case.

On the other hand, from the point of view of the authorization check, there is no usage mode in which the same user is checked for authorization simultaneously on several terminals and logs on.

At the time of the authorization check execution, when the authorization check priority is read, no authorization check can take place for the user who is logged on to the other terminal. Therefore, the system of the present invention improves the authentication performance by excluding the user who logs on to the other terminal from the authentication priority list based on that location.

The removal (masking) from the list changes dynamically based on the user usage situation at the time the authorization check request occurs. Therefore, the system of the present invention copies the authentication priority list as a temporary table to allow temporary changing of that table, and then performs an authentication using this temporary authentication priority list to perform an usage-based authentication.

The functions of this element include an authentication data acquisition function, a terminal relationship calculation function, and a terminal relationship data storage function.

Example of a concept for managing terminal groupings

The following is an example of how the concept for managing terminal groupings works. The method of calculating terminal relevance (terminal relationship) is only an example, and another method of calculating terminal relevance based on the authentication protocol of each terminal could be used.

For the target terminal, data is recorded on which terminal the user who carried out the next authorization check is located. A function merges the recorded results for a certain period of time and calculates the device relevance index of each device in relation to other devices. The calculation result is a ratio (%) to which terminal the user logged on to the relevant terminal has logged on to the next terminal. This calculation result is stored in the "terminal relationship DB: terminal relationship table".

For the terminal (Y), the relevance index (%) of the terminal (X) = number of registrations on terminal Y after logging on to terminal X within the desired period / number of registrations on terminal X within the relevant period.

In an environment in which customer tasks are performed while multiple neighboring shared terminals are shared, the user conducts his business operation on the empty terminal without being aware that it is a unique terminal.

In such circumstances, the creation of an authorization check priority list from usage data of only one terminal does not lead to the creation of a list which reflects the actual usage.

Therefore, the system creates the priority list using relevant terminal data with a weighted factor after a dynamic relationship factor between terminals has been determined. The 4A and 4B show the terminals 1 and 2, in which the circled elements "A" represent an authorization check of the user "A" and the circled elements "B" represent an authorization check of the user "B".

4A shows a case in which the relevance between the terminal 1 and the terminal 2 is zero regardless of the physical location of the terminal.

4B shows a case where the relevance between the terminal 1 and the terminal 2 is quite high regardless of the physical location.

Create the authorization check priority list

5 shows a flow diagram of a method for relationship analysis and priority list creation. The process of 5 can be done daily or weekly and does not have to be done after each approval, although it could be done after each approval if processor resources allow it.

In a first step, the authorization check program calculates 66 based on the authorization check result table, a terminal usage ratio per time window and stores the terminal usage ratio per time window in the terminal usage ratio table (step 280 ).

The authorization check program 66 calculates a terminal relationship and stores the terminal relationship in the terminal relationship table (step 282 ).

The authorization check program 66 then calculates the authentication priority based on the terminal relationship, the terminal usage ratio table and the authentication result, and stores the authentication priority in the authentication priority table (step 284 ), and the process ends.

An authorization check priority list is created for each corresponding terminal. The authorization check priority list of the time window X of the terminal (W) is calculated using the following procedure:

Estimation of the authorization check usage ratio per target time window of the corresponding terminal

The user (Y) assumed an authorization check usage relationship in the time window (X) of the corresponding terminal (W).

Estimation of the authorization check usage ratio per target time window of the corresponding terminal = (relevance index (%) for the target terminal (Z) of the corresponding terminal (W)) x (percentage of use (%) in the time window (X) of the target terminal (Z)). It should be noted that this calculation is carried out for all target terminals as well as for all users.

Creation of the priority list

The priority of the corresponding terminal (W) in the time window (X) is created as a priority list by sorting in descending order in the direction of the authorization check usage relationship assumed by the user (Y) in the time window (X) of the corresponding terminal (W).

Storage and database

The following various tables show examples of tables that are kept in memory by any mechanism in this system. It will be clear that the actual details in a system depend on the actual form of implementation. Table E.1: User information database - user information table Shared user account ID Biometric data Data file A User name user ... Data file N User name user 001 / xxx / 123456_1 John Doe A ... / xxx / 123456_N Bill Clark B 002 / xxx / 234567_1 Bill Roe E ... / xxx / 123456_1 John Doe A ... ... ... ... 00n / xxx3452452_ 1 Jane Doe D ... / xxx / 3452452_N Bob Jones XX

Note in this example the difference between "users", who are people with their associated biometric data (who are identified by the letters A to XX for example), and "shared user account IDs", which are System identifiers that are used to log on to a terminal (which are identified with the numbers 001 to 00n for example).

Each common user account identifier could be used by a number of different users, which may result in multiple users associated with a common user account identifier, each user having his or her own (biometric) credential data. The user information table lists various users associated with each user ID and the biometric data used to identify that user.

In this system, a common user account ID can only be used to log on to a single terminal at a time, while a user can be logged on to a number of terminals at the same time - for example, in a case where a main cashier moves from one cash register to another during a shift must change. Table E.2: Entitlement Check Results Database Entitlement Check Results Table Process number date Date / time Terminal IP addr. Shared user account ID user 20151123000 1 11/30/2016 10:11:12 1 192.10.1.1 001 B 20151123000 2 11/30/2016 10:11:15 1 192.10.1.1 001 C. 20151123000 2 11/30/2016 10:11:15 1 192.10.1.1 001 A ... ... ... ... ... 20151123000x 11/30/2016 10:15:33 1 192.10.1.1 002 C.

In the examples, individual devices are identified by a simple number 1 to x at each IP address, but it will be clear that the device can alternatively be identified by the IP address itself, an alphanumeric identifier (“shoe department”) or a host -Name or a host ID ("Ithaca-Schuhregisterkasse 1") can be identified. Table E.3: Terminal usage status DB: terminal usage ratio per time window date Time window Terminal user A B C. ... XX 11/29/2016 09: 00-10: 00 1 15% 35% 25% ... 0% 11/29/2016 09: 00-10: 00 2nd 50% 0% 20% ... 0% ... ... ... ... ... ... ... ... 11/29/2016 09: 00-10: 00 x 0% 0% 0% ... 100% ... ... ... ... ... ... ... ... 11/29/2016 17: 00-18: 00 1 50% 25% 0% ... 0% 11/29/2016 17: 00-18: 00 2nd 0% 40% 30% ... 0% ... ... ... ... ... ... ... ... 11/29/2016 17: 00-18: 00 x 0% 0% 20% ... 60%

Note in the example of Table E.3 that the result is a login usage ratio of 15% for User A and 35% for User B and 25% for User C in a target period from 9:00 a.m. to 10:00 a.m. shows specific day.

This information can be used to set up the authentication priority table - those users who are most likely to use the terminal are assigned a higher priority for the terminal within a certain time window than users who are less likely to use this terminal in this time window (or as good as not use. For the authorization check priority table, see the following table E.5. Table E.4: Terminal relationship database - Terminal relationship table Terminal (target for relationship) 1 2nd ... x Terminal (origin) 1 70% 20% ... 4% 2nd 30% 50% ... 13% ... ... ... ... ... x 5% 14% ... 70%

In Table E.4, the relationship between terminal 1 and terminal 2 is 20%. This ratio means that the user who has logged on to terminal 1 at terminal 1 will log in 20% of terminal 2 the next time he logs on.

The terminal relationships from this table can be combined with the data from the terminal usage table E.3 to determine the overall priority, which is stored in the following table E.5.

This table provides information about those terminals that are used among some specific groups in which users frequently change terminals during a certain period of time. The setting of priorities not only calculates the use of a single end device but also taking into account the use of several end devices. And in this situation, terminal relationship data from Table E.4 is used.

• Geschätzte Endgerätenutzung für Endgerät (W) im Zeitfenster (T) = ${\displaystyle {\sum }_{i=1}^x}$
  
  (Endgerätebeziehung zwischen Endgerät (W) und Endgerät (i) aus Tabelle E. 4 xx Endgerätenutzungsverhältnis für Endgerät (i) im Zeitfenster (T) aus Tabelle E.3),
• wobei die Summierung auf alle Endgeräte angewendet wird, die mit „Endgerät 1“ bis „Endgerät x“ bezeichnet sind.

Tabelle E.5: Berechtigungsprüfungs-Prioritätsdatenbank-Berechtigungsprüfungs-Prioritätstabelle Endgerät Datum Zeitfenster Berechtigungsprüfungspriorität Priorität 1 Priorität 2 Priorität 3 ... Priorität N 1 30.11.2016 09:00-10:00 Benutzer B Benutzer C Benutzer A ... Benutzer G 2 30.11.2016 10:00-11:00 Benutzer B Benutzer A Benutzer Q ... Benutzer XX ... ... ... ... ... ... ... x 30.11.2016 23:00-24:00 Benutzer XX Benutzer Q Benutzer E ... Benutzer FF Terminal usage data for the authorization check priority taking into account the usage of multiple terminals and the terminal usage relationship are obtained, for example, by the following formula:

• Estimated end device usage for end device (W) in time window (T) ${\displaystyle {\sum }_{i=1}^x}$
  
  (Terminal relationship between terminal (W) and terminal (i) from table E. 4 xx terminal usage ratio for terminal (i) in the time window (T) from table E.3),
• whereby the summation is applied to all end devices that are labeled “End device 1” to “End device x”.

Table E.5: Entitlement Check Priority Database Entitlement Priority Table Terminal date Time window Authority check priority Priority 1 Priority 2 Priority 3 ... Priority N 1 11/30/2016 09: 00-10: 00 User B User C User A ... User G 2nd 11/30/2016 10: 00-11: 00 User B User A User Q ... User XX ... ... ... ... ... ... ... x 11/30/2016 23: 00-24: 00 User XX User Q User E ... User FF

In Table E.5, the example shows that the authorization check priority for terminal 1 in the time window 9:00 a.m. to 10:00 a.m. on November 30, 2016 relates to user B (based on his 35% use of this terminal in the same time window on the previous day ), then user C (25%), then user A (15%) ... finally user XX (who has not used this terminal during the entire previous day).

Flow chart of the procedure of the 1: N authorization check

6 shows a flowchart of the method of the 1: N authorization check.

In this example, the common user account ID 001 stands for all users in a single group - for example, for the employees of the shoe department in a department store. The shoe department could have a number of cash register terminals, which are labeled "Terminal 1" to "Terminal x", with all terminals in the departments being opened by the shared user account ID 001 when the department store is opened. Each of the twenty-six employees in the department is identified by a letter, for example, user "A" ... user "Z", and each of the twenty-six employees has their own biometric data for authentication purposes. All of the twenty-six employees are unlikely to be in the department store in any time slot, since everyone has their own working time, but if they are present, they may need to be checked for authorization on any of the devices 1 to x (themselves Sign in).

Now a user (user M) wants to log on to a target terminal on November 30, 2017 at 9:30 a.m., for example on terminal 1. The user may have previously logged on to one or more other terminals. The user enters his credentials (for example, he puts his thumb on a reader or enters his code on the cash register keypad).

In the prior art, the system would then have to perform the authentication process for each of the users (users A through Z) in the group (shared user account ID 1, the shoe department) until it found a match in the biometric data for a new user. For example, if the biometric data were sequenced based on the user name, the system would go through each of the users from user A to user L before finding user M's match. Therefore, the system would go through the authentication process twelve times. It is obvious that this could take a considerable amount of time for larger groups.

This situation can be improved by prioritizing the users who could be expected to log on to a specific terminal in a specific time window. This can be stored in an authorization check priority table. The authorization check priority table contains the following information: Table F.1: Authorization check result table Terminal date Time window Authority check priority Priority 1 Priority 2 ... Priority n ... Priority x 1 11/30/2016 09: 00-10: 00 User B User C ... User M ... User Q 2nd 11/30/2016 09: 00-10: 00 User A User C ... User D ... User X ... ... ... ... ... ... ... ... ... x 11/30/2016 09: 00-10: 00 User D User B ... User Q ... User F

From the step 222 from 3rd , at which the user M wants to log on to the terminal 1 for the common user account ID 001, calls the authorization check program 66 Entries from the authorization check priority table for the target terminal in the current time window from (step 302 ).

The information extracted from the target terminal table would be as follows: Table F.1 (a) - Entitlement Check Priority Table for Target Terminal Terminal date Time window Authority check priority Priority 1 Priority 2 ... Priority n ... Priority x 1 11/30/2016 09: 00-10: 00 User B User C ... User M ... User Q

This indicates that the user M is in the list on the priority n for the terminal 1 in this time window. If the method simply used this priority table, the system would only have to check (n-1) sets of authentication data before user M data is reached. Assuming that only a relatively small subset of users has priority for this terminal at this time (ie (n - 1) <12), this would shorten the login time for user M.

However, the current process improves the authentication process, as discussed below. The authorization check program 66 reads the authorization check status for the other end devices from the authorization check results table (step 308 ). Table F.2: Authorization check result table Process number date Date / time Terminal user 201511230001 11/30/2016 09:11:12 Terminal 3 User A 201511230002 11/30/2016 09:11:15 Terminal 11 User B 201511230003 11/30/2016 09:11:17 Terminal 12 User C 201511230004 11/30/2016 09:13:20 Terminal 8 User G 201511230005 11/30/2016 09:20:23 Terminal 11 User D 201511230006 11/30/2016 09:25:29 Terminal 11 User N ... ... ... ... ...

The authorization check program thus determines that user A is currently logged on to terminal 3, users B, D and N are currently logged on to terminal 11, user C is currently logged on to terminal 12 and user G is logged on to terminal 8, as noted above . Other users are logged on to other devices.

The one in step 308 Read authentication status is then used to create a temporary authentication priority table by adding priority information and a mask status as noted below (step 310 ). Additional data is added for each priority to indicate a mask status. Since the mask status has two states, the example defines the status states as "true" in the meaning of "masked" and "false" in the meaning of "not masked". It will be clear that any other code could be used for this function, for example a simple binary number 0 or 1 etc.

Every user who is already logged on to another device is masked - that is, a mask value "true" is assigned to him in this example. If only the masking for the target terminal is considered, the table would be as follows: Table F.3: Temporary authorization check priority table Terminal ... Authority check priority Priority 1 Mask for 1 Priority 2 Mask for 2 ... Priority n Mask for n ... 1 ... User B True User C True ... User M Not correct ...

In this example, the first two priority entries are masked ("true"), since these users have been checked for authorization elsewhere. It is assumed that other users prioritized as priority 3 to (n - 1) are also logged on and are therefore also hidden.

It should be noted that if a user logs off from a terminal, the masking for this user would be removed in the authorization check priority table at all locations where it occurs.

The "authentication check priority table" differs from the "temporary authentication priority table" as follows:

Status change: The authorization check priority table contains a static status between the measurement interval for statistics of the authentication company, hourly, daily or weekly. On the other hand, the temporary authentication priority table can dynamically change its data and masking status based on the operation of the authentication checks.

Storage location: Since the authorization check priority table is of a static type, these tables are preferably stored in a data store or a storage medium. On the other hand, the temporary authentication priority table must be able to change its masking status promptly and quickly, so that these tables should be stored in processor main memory.

Creating the Table: The temporary authentication priority table is created by loading the authentication priority table from memory to main memory in a modified form as noted above.

The authorization check program 66 then performs a 1: N authentication check using the temporary authentication priority table (step 312 ).

Therefore, when user M tries to log on to terminal 1, the system does not attempt an authorization check with information from user B or information from user C or any of the other users in the priorities 3 to (n-1). These users are skipped (“masked”) and the system goes directly to priority n - user N - who successfully passes the authorization check on the first attempt.

This improves the performance of the system since the authorization check does not have to be carried out against the biometric data of any user who is already logged on elsewhere (whose entries are masked) and the other users based on their priority (probability that the user will agree to this Time at this end device), so that the system can first carry out the authorization check for those users who are most likely trying to be checked for authorization.

It should also be noted that user M would also be hidden if he were logged on to another terminal - the mask for priority n would be "true". In this case, user M would not be able to be checked for authorization on terminal 1. This would enforce security by forcing a user to log off on one of the devices they are using before logging on elsewhere. Alternatively, the system could be set up in such a way that a user is automatically logged off after a period of inactivity, so that the masking would be removed automatically, as a result of which a user can move freely from terminal to terminal as long as there is a predetermined time between logins.

If the authorization check has been accepted by the terminal (step 314 ), access to the terminal device is granted (step 316 ), the authorization check result is stored in the authorization check table (step 318 ) and the process ends.

If the authorization check was not accepted by the terminal (step 314 ) the authorization check result is stored in the authorization check table (step 318 ), a message is sent to the terminal indicating that the authorization check was not accepted (step 320 ), and the process ends.

Main elements of the system:

Element 1: Execution mechanism for processing the hybrid authorization check

In response to the authorization check request of the user, an authorization check is carried out by checking the entered biometric information of the target user with stored biometric authorization check reference data and stored authorization check reference data of the biometric information for authorization. This system realizes the 1: 1 authorization check and also the 1: N authorization check.

The 1: N authorization check process is carried out by end devices in accordance with the relevant authorization check priority.

In addition, this 1: N authorization check confirms the shared user account ID that has been registered by another terminal, and the shared user account registered by the other terminal is masked in the authorization check priority list in order to exclude it from the authorization check targets.

Element 2: Device relevance calculation function

A calculation of the dynamic grouping of end devices, i.e. of dependency relationships between terminals based on the authentication result data in the user terminal is stored.

Element 3: Function for creating the authentication priority list

Creates and stores an authentication priority list for each predefined condition, for example time, based on the authentication protocol for each terminal and the dependency relationship data between the terminals.

Other elements

The present invention can be a system, a method and / or a computer program product in any possible degree of integration of technical details. The computer program product may include a computer readable storage medium (or media) on which computer readable program instructions are stored to cause a processor to implement aspects of the present invention.

The computer readable storage medium may be a physical unit on which instructions for use by an instruction execution unit may be stored and stored. For example, but not limited to, the computer readable storage medium may be an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard drive, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM) or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a DVD (digital versatile disc), a memory stick, a floppy disk, a mechanically coded one Unit such as punch cards or raised structures in a groove on which instructions are stored and any suitable combinations of the above. A computer-readable storage medium in the sense used herein is not to be interpreted as being volatile signals, e.g. radio waves or freely propagating electromagnetic waves, electromagnetic waves that propagate through a waveguide or other transmission media (e.g. light pulses that pass through an optical fiber cable) or electrical signals that are transmitted via a cable.

Computer-readable program instructions described herein can download a wide area network and / or a wireless network from a computer-readable storage medium to relevant data processing / processing units or to an external computer or an external storage unit via a network, for example the Internet, a local area network become. The network can include copper transmission cables, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or interface at each computing / processing unit receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective data processing / processing unit.

Computer readable program instructions for performing operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, stateful data, or either source code or object code act that are written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C ++ or similar. as well as procedural programming languages such as Programming language "C" or similar programming languages. The computer-readable program instructions can be executed entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remotely located computer or entirely on the remotely located computer or server. In the latter scenario, the remotely located computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, via the Internet using an Internet service provider). In some embodiments, electronic circuitry may include, for example, programmable logic circuitry, field programmable gate arrays (FPGA), or programmable logic arrays (PLA) that execute computer-readable program instructions by providing state information of that readable by a computer Program instructions can be used to personalize the electronic circuit so that aspects of the present invention are carried out.

Aspects of the present invention are described herein with reference to flowchart representations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the invention. It will be appreciated that each block of the flowcharts and / or the block diagrams and combinations of blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions.

These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer or other programmable data processing device in order to generate a machine, so that the instructions which are executed via the processor of the computer or other programmable data processing device provide means for to implement the functions / actions specified in the blocks of the flowchart or the flowcharts and / or the block diagram or the block diagrams. These computer readable program instructions may also be stored in a computer readable medium that can instruct a computer, other programmable computing device, or other device to function in a particular manner such that the computer readable medium has instructions stored thereon Product which contains instructions that implement the function / action specified in a block or in the blocks of the flowcharts and / or the block diagrams.

The computer readable program instructions may also be loaded into a computer, other programmable computing devices, or other devices to cause a series of operations to be performed on the computer, other programmable devices, or other devices, such as by a computer create an implemented process so that the instructions that are executed on the computer, on other programmable devices or units, implement the functions / actions specified in a block or in the blocks of the flow diagrams and / or the block diagrams.

The flow diagrams and block diagrams in the figures illustrate the architecture, functionality and mode of operation of possible forms of implementation of systems, methods and computer program products according to various embodiments of the present invention. In this context, each block in the flowcharts or in the block diagrams can represent a control component, a segment or a section of instructions which has one or more executable instructions for realizing the specified logic function or functions. In some alternative implementations, the functions specified in the block can take place in a different order than shown in the figures. For example, two blocks listed in sequence can actually be executed substantially simultaneously, or the blocks can sometimes be executed in reverse order depending on the functionality associated with the blocks. In addition, it should be noted that each block of the block diagrams and / or flow diagrams shown, as well as combinations of blocks in the block diagrams and / or flow diagrams shown, are used with the aid of dedicated hardware-based systems for executing the specified functions or actions or with the aid of combinations of dedicated hardware and purpose-bound Computer instructions can be realized.

Claims (18)

Computer-implemented method for checking the authorization of users on several end devices, the method comprising the steps: a) receiving user input by a computer in order to start an authorization check on a target terminal that has biometric input from the user; b) the computer determining whether the biometric inputs received from the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) if the user is the same user who was last checked for authorization by the computer for the target terminal, the computer performing a 1: 1 authorization check of the user; d) if the user is not the same user who was last checked for authorization by the computer for the target terminal, by the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status on terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, the masking applying to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authorization check has been accepted, the computer granting user access to the target terminal and storing the authorization check result in the authorization check result table. Procedure according to Claim 1 wherein the authentication priority for the authentication priority table is determined by the steps comprising: the computer calculating a terminal usage ratio per window based on the authentication result table and storing it as a terminal usage ratio table; computing by the computer a terminal relationship and storing as a terminal relationship table; and by the computer calculating the authentication priority based on the terminal relationship table, the terminal usage ratio table and the authentication result and storing the authentication priority in the authentication priority table. Procedure according to Claim 2 , wherein the terminal usage ratio per time window is based on a relevance index of the number of logins of a user to the terminal within a time window for the terminal and the percentage of use of the terminal in a time window. Procedure according to one of the Claims 2 or 3rd , wherein the authorization check priority is a probability that a user will use the target terminal during a certain time window. Method according to one of the preceding claims, wherein if the 1: 1 authorization check is accepted, the authorization check result is stored in the authorization check result table and access is granted to the target terminal. Method according to one of the preceding claims, wherein if the 1: 1 authorization check is refused, a return to step d) i) of retrieving entries from an authorization check priority table for the target terminal takes place in a current time window. A method according to any one of the preceding claims, wherein the authentication priority list is based on an earlier authentication status of users with respect to a terminal. Method according to one of the preceding claims, wherein the temporary authorization check table is stored in the main memory and the authorization check priority table is stored in a data store. Computer system for checking the authorization of users on a plurality of terminals, which has a computer which has at least one processor, one or more memories, one or more computer-readable storage media on which program instructions are stored which can be executed by the computer a) receiving by the computer user input that has biometric input from the user to start the authorization check on a target terminal; b) the computer determines whether the biometric inputs received from the user indicate that the same user starts an authorization check on the target terminal that was last checked for authorization by the computer for the target terminal; c) performing a 1: 1 authorization check of the user by the computer if the user is the same user who was last checked for authorization by the computer for the target terminal; d) if the user is not the same user who was last checked for authorization by the computer for the target terminal, by the computer: i) retrieving entries from an authorization check priority table for the target terminal in a current time window; ii) reading an authentication status at terminals other than the target terminal based on an authentication result table; iii) creating a temporary authentication priority table comprising: user priority information for each terminal, time, terminal information, and user masking on terminals based on the authentication result table, where the masking applies to any user who is already logged on to terminals and which is not the user who is currently starting the authorization check on the target terminal; iv) performing a 1: N authentication check of the user using the temporary authentication table; v) determining whether the 1: N authorization check has been accepted; and v) if the 1: N authorization check has been accepted, by the computer granting user access to the target terminal and storing the authorization check result in the authorization check result table. Computer system after Claim 9 wherein the authentication priority for the authentication priority table is determined by the program instructions comprising: the computer calculating a terminal usage ratio per time window based on the authentication result table and storing it as a terminal usage ratio table; computing by the computer a terminal relationship and storing as a terminal relationship table; and by the computer calculating the authentication priority based on the terminal relationship table, the terminal usage ratio table and the authentication result and storing the authentication priority in the authentication priority table. Computer system after Claim 10 , wherein the terminal usage ratio per time window is based on a relevance index of the number of logins of a user to the terminal within a time window for the terminal and the percentage of use of the terminal in a time window. Computer system after Claim 10 or 11 , wherein the authorization check priority is a probability that a user will use the target terminal during a certain time window. Computer system after one Claims 9 to 12th , wherein if the 1: 1 authorization check is accepted, the authorization check result is stored in the authorization check result table and access is granted to the target terminal. Computer system after one Claims 9 to 13 , where a 1: 1 authorization check is refused, a return to step d) i) of retrieving entries from an authorization check priority table for the target terminal takes place in a current time window. Computer system after one Claims 9 to 14 wherein the authentication priority list is based on a previous authentication status of users with respect to a terminal. Computer system after one Claims 9 to 15 , wherein the temporary authentication table is stored in the main memory and the authentication priority table is stored in a data store. A computer program product for checking the authorization of users on a plurality of terminals, the computer program product comprising: a computer-readable storage medium which can be read by a processing circuit and on which storage instructions for execution by the processing circuit are stored, according to a method according to one of the Claims 1 to 8th perform. Computer program, which is stored on a computer-readable medium, can be loaded into the internal main memory of a digital computer and software code sections for carrying out the method according to one of the Claims 1 to 8th if the program is running on a computer.

Images